Cloud Complexity Mandates Security Visibility

The cloud is flexible, but security should be the top priority.

While cloud adoption continues at a fiery pace, the speed to migrate to this new platform sometimes comes at the cost of attention to critical security needs. CIOs certainly recognize and plan for data security, but because the cloud operates as a new paradigm, some IT professionals don’t fully understand the complexity of their new environment and how to be secure within it.

Ironically, the cloud is definitely a more complex environment, but it is also more flexible in serving customer's needs. To build an effective and secure cloud environment, your organization needs visibility across how your data and users are engaging with your environment, and how your various stakeholders are changing your infrastructure.

Let's first think about complexity, and we can start by questioning what that means in the context of a public cloud platform. Complexity doesn't have to mean difficult, however, and this is an important distinction. Among the selling points of the cloud is that it makes the life of IT admins easier; fewer physical assets to manage, a decreased reliance on technology expertise, and an easing of the overall technology coordination burden. While these things are true, ease of use and an elimination of some of the more arduous management duties is only part of the cloud story.

There are two aspects related to security that require attention, and herein is where you can see where things can get a bit complex:

Cloud vendors use a shared responsibility model for how security management is conducted. This requires customers to maintain an always-on awareness of their responsibilities within the cloud. It is ultimately up to you as the cloud customer to ensure a secure and compliant environment for your own operations. Less work perhaps, because you don’t have physical assets to manage, but far from easy.

The cloud stack is made up of various elements, and each one requires different security and compliance requirements. The storage layer, for example, requires securing data access, having data encryption policies, and other types of rules for things like logging and versioning. With six different layers of the cloud stack, and with dependencies among them, there has to be some level of continuous coordination to ensure these pieces are all secure and compliant.

While I hope I've made the case for recognizing and handling complexity, it's also really important to understand that with the right type of security tools, much of the work of identifying vulnerabilities in the cloud can be handled in a continuous, automated way; this is one of the ways we distinguish between complexity and difficulty. All this complexity can be mitigated, in terms of the amount of work, but to do so requires visibility.

Cloud security is, in large part, about awareness. This includes the need to maintain visibility into your cloud environment at all times, the ability to act upon any issues identified to mitigate risks, and the need for increased automation of security efforts to apply emerging best practices as consistent and enforceable behaviors.

It’s impossible to properly secure dynamic cloud environments without truly knowing every interaction within your environment and in all corners of your cloud. In today's cloud platforms, however, things like elastic infrastructures and API-driven cloud service suites have changed the way security needs to be architected, implemented, and managed throughout the workload lifecycle.

The lack of skilled cloud resources has further compounded the problem. Countless IT and cloud security teams grapple with the ambiguity of what to monitor, when to monitor it, how to identify evidence of compliance, overall reporting requirements, and so on. What is clear is the need for automation in dynamic, cloud-centric environments. Without continuous automation and assessment, organizations lack timely visibility into infrastructure configuration and workload risk and will have a hard time proving any form of compliance in the cloud.

With increased visibility, teams can quickly mitigate the most common vulnerabilities in minutes to drastically reduce the organization’s threat surface, and then focus resources on issues that require more time and attention to fix.

Tim Prendergast co-founded Evident.io to help others avoid the pain he endured when helping Adobe adopt the cloud at a massive level. After years of building, operating, and securing services in Amazon Web Services, he set out to make security approachable and ... View Full Bio

Published: 2017-05-09NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.